Threats tagged 'ghsa-jqr2-6x6h-fvmp'

CVE-2026-16262 is a Cross-Site Request Forgery (CSRF) vulnerability in the Estatik Real Estate Plugin for WordPress before version 4.3.3. The flaw allows an unauthenticated attacker to log a victim into an attacker-controlled account by exploiting the OAuth social login flow, which is not properly bound to the initiating user session. This causes the victim's subsequent activity to be associated with and accessible by the attacker. The vulnerability has a high severity rating with a CVSS score of 7.5.